Log in Start free

Vulnerability · Published May 25, 2021 · Assigned by mitre

CVE-2021-31924

Medium 6.8

In plain English

A medium-severity security flaw in the pam-u2f package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.8Medium
Exploit odds (30 days)0.3%top 73.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pam-u2f1.1.1-r0ALPINE-CVE-2021-31924
Alpine:v3.21pam-u2f1.1.1-r0ALPINE-CVE-2021-31924
Alpine:v3.22pam-u2f1.1.1-r0ALPINE-CVE-2021-31924
Alpine:v3.23pam-u2f1.1.1-r0ALPINE-CVE-2021-31924
Alpine:v3.24pam-u2f1.1.1-r0ALPINE-CVE-2021-31924
Debian:12pam-u2f1.1.0-1.1DEBIAN-CVE-2021-31924
Debian:13pam-u2f1.1.0-1.1DEBIAN-CVE-2021-31924
Debian:14pam-u2f1.1.0-1.1DEBIAN-CVE-2021-31924
Ubuntu:22.04:LTSpam-u2fno fix listedUBUNTU-CVE-2021-31924
Ubuntu:24.04:LTSpam-u2fno fix listedUBUNTU-CVE-2021-31924

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References